With the development of Internet technology, more and more Trojan horse programs are spread in networks. Trojan horse programs, usually called Trojan horses, are a kind of malicious code, which may hide in a computer and may be controlled by an external user to steal information or control authority of the computer. Most Trojan horse programs have malicious intentions and cause harm, for example, by occupying system resources, decreasing the efficiency of the computer, endangering information security of the computer (such as stealing a QQ account, a game account or even a bank account), and utilizing the computer as a tool to attack other devices, and so on.
Typically, a relationship between a Trojan horse file stored in a matrix and a Trojan horse file stored in a child of the Trojan horse, including the downloading addresses of the Trojan horse files may be obtained by manual analysis and running of a virtual machine. Md5s output, which may include an abstract data type, produced by processing of the matrix and the child may be stored in conjunction with the downloading address for the Trojan horse file for later query.